New NIST cybersecurity standards could pose liability risks

Once passed, the standard will become the benchmark to measure critical infrastructure security programs

"If a company gets sued, it should be able to provide some evidence that they took a look at the standards, performed a risk assessment and were managing their risk in a reasonable manner, Wool said.

Scott Vernick, an attorney at Fox Rothschild in Philadelphia said that there is a good chance that the NIST standards will eventually become sector-specific regulations overseen by the federal agencies in charge of various critical infrastructure areas. At that point, covered entities will have no choice but to adopt the standards, he suggested.

Even if that's wrong, "once NIST finishes its work, the Plaintiffs Bar will point to it as the standard," Vernick said. Critical infrastructure owners and operators should, at a minimum, determine how their security measures stack up against the standard, he said.

Companies should also consider joining information sharing initiatives and other cybersecurity forums to show they are making an effort to understand new threats, he said. "This really is an area where an ounce of prevention is worth a pound of cure."

Ironically, even companies that do adopt the framework may not be free from liability risks, experts say.

For instance, some of the provisions for protecting personally identifiable information (PII), could be pose problems for critical infrastructure companies, said Stewart Baker, former assistant secretary for policy under the George W. Bush administration, in a blog post.

The privacy appendix would require that companies take extensive measures to protect PII while carrying out cybersecurity functions, said Baker now an attorney in the Washington office of the Steptoe & Johnson LLP law firm.

For example, companies that want to share threat-information with other firms will have to first scrub the data so it's clean of personally identifiable information.

Baker said the requirements in the draft document are ambiguous and open to interpretation.

Companies that share threat information containing personal data, like IP addresses and email addresses, face few legal consequences as long as the government is kept out of the picture.

"Once the NIST privacy appendix takes effect, though, private cybersecurity sharing will slow to a crawl as lawyers try to anticipate whether every piece of data has been screened for PII and for relevance," Baker noted. "In short, under the NIST framework, pretty much every serious cybersecurity measure in use today will come with new limits and possibly new liability," he said.